With the advent of electronic banking, financial institutions and their customers may increasingly be subject to improper financial activity on one or more accounts. In some cases, individual persons may be solely responsible for making the improper financial transactions. However, in other cases, a “ring” of individuals may work together in performing more widespread improper financial activity. In such cases, both the customers of the financial institution and the financial institution itself may be subject to a higher risk of financial loss as a result of the ring's activities. To uncover the ring's activities, financial institutions may monitor financial transactions for indications of improper financial activity. When an indication is found, the associated financial transaction may be flagged for further analysis. Information about the flagged financial transactions may be aggregated, or otherwise grouped, for further analysis. For example, the information may be referred to an analytics department of the financial institution to determine whether an indicator of coordinated improper financial activities may be found.
In such cases, an analyst may receive a referral including information about one or more flagged financial transactions. The analyst may then manually construct queries of one or more data stores storing financial transaction information. The analyst may use their own discretion to determine which data may be relevant. The analyst may continue until they believe that they have an understanding of a pattern of activity, if any. Such a procedure may be time consuming and/or expensive, because each incremental piece of linked data takes time to obtain, to analyze, and to determine whether more information is needed. These methods may also lead to inconsistent results, because the amount of data retrieved is often left to the analyst's discretion.